Fast Keyword Search over Encrypted Data with Short Ciphertext in Clouds

Fast Keyword Search over Encrypted Data with Short
 Ciphertext in Clouds

 Yi-Fan Tsenga , Chun-I Fanb,c,d,∗, Zi-Cheng Liub
 a Department of Computer Science, National Chengchi University, Taipei, Taiwan.
 b Department of Computer Science and Engineering, National Sun Yat-sen University,
 Kaohsiung, Taiwan
 c Information Security Research Center, National Sun Yat-sen University, Kaohsiung,

 Taiwan
 d Intelligent Electronic Commerce Research Center, National Sun Yat-sen University,

 Kaohsiung, Taiwan

Abstract

Nowadays, it is convenient for people to store their data on clouds. To pro-
tect the privacy, people tend to encrypt their data before uploading them to
clouds. Due to the widespread use of cloud services, public key searchable
encryption is necessary for users to search the encrypted files efficiently and
correctly. However, the existing public key searchable encryption schemes sup-
porting monotonic queries suffer from either infeasibility in keyword testing or
inefficiency such as heavy computing cost of testing, large size of ciphertext or
trapdoor, and so on. In this work, we first propose a novel and efficient anony-
mous key-policy attribute-based encryption (KP-ABE). Then by applying Shen
et al.’s generic construction proposed to the proposed anonymous KP-ABE, we
obtain an efficient and expressive public key searchable encryption, which to
the best of our knowledge achieves the best performance in testing among the
existing such schemes. Only 2 pairings is needed in testing. Besides, we also
implement our scheme and others with Python for comparing the performance.
From the implementation results, our scheme owns the best performance on
testing, and the size of ciphertexts and trapdoors are smaller than most of the

 ∗ Corresponding author
 Email addresses: yftseng@cs.nccu.edu.tw (Yi-Fan Tseng),
cifan@mail.cse.nsysu.edu.tw (Chun-I Fan), tcdiadem@gmail.com (Zi-Cheng Liu)

Preprint submitted to Journal of LATEX Templates August 4, 2021

existing schemes.
 Keywords: Public Key Searchable Encryption, Key-Policy Attribute-Based
 Encryption, Anonymous KP-ABE, The Standard Model, Monotonic Access
 Structure

 1. Introduction

 Cloud computing has been thriving around the world recently. People tend
 to store their data on clouds so that they can back up the data and retrieve them
 anytime and anywhere. Consider the following scenario. In a company, employ-
 5 ees are asked to store the commercial documents in the company’s private cloud.
 In order to prevent unauthorized access, it is necessary to store the documents
 in encrypted form. Besides, the documents may come from customers, and thus
 they should be transmitted in encrypted form. This is a common business model
 of nowadays. In such scenario, it is significant for the employees to efficiently
10 and securely search the required encrypted files. A practical solution to this
 problem is to apply searchable encryption.

 1.1. Related Works

 In 2000, Song et al. [1] first gave the definition of searchable encryption (SE).
15 In an SE scheme, a data owner can encrypt keywords and upload it with the en-
 crypted data so that users can find the desired data by searching the encrypted
 keywords. In 2004, Boneh et al. [2] first proposed a public key encryption with
 keyword search (PEKS) (a.k.a. public key searchable encryption). They com-
 bined the public key setting and the keyword search encryption, and discussed
20 the relationship between PEKS and identity-based encryption (IBE). Note that
 public key searchable encryption is different from private key searchable encryp-
 tion (a.k.a. searchable symmetric encryption) [3]. The former belongs to the
 family of public key primitives, where an encryptor is allowed to be different
 to the owner of private key, while in a private key searchable encryption, the

 2

25 one who encrypts the data must be the same as the one who is able to decrypt
 the data. In this manuscript, we focus on solving the emerging problems in the
 realm of PEKS. Following Boneh’s pioneering work, Abdalla et al. [4] proposed
 a generic construction of PEKS from anonymous IBE, where an encryption re-
 veals nothing about its receiver. However, [4, 2] only support equality queries.
30 It is necessary to construct an PEKS scheme with more expressive queries such
 as conjunction, disjunction and monotonic formulas to make the search more
 accurate and flexible. In 2007, Boneh et al. [5] proposed a searchable encryption
 scheme supporting conjunctive, subset, and range queries in public key setting.
 In the next year, Katz et al. [6] first introduced inner-product predicate encryp-
35 tion (IPE) [7, 8] which can be extended to PEKS supporting disjunctive queries.
 Nevertheless, it is inefficient in this way because the size of the ciphertext and
 the search token would superpolynomially blow up [9]. Another shortcoming of
 Katz et al.’s work is that, their scheme is constructed under composite-order bi-
 linear groups whose performance is notoriously worse than prime-order bilinear
40 groups. According to [10], the length of a group element in a composite-order
 group is 12 times larger than that in a prime-order group. Besides, the bilinear
 pairings in composite-order groups are 254 times slower than those in prime-
 order groups for the same 128-bit security. In 2018, there are several related
 works [11], [12],[13],[14] that have been proposed. In these schemes, the au-
45 thors explored keyword search in attribute-based encryption so that the scheme
 can support access control and keyword search simultaneously. However, these
 schemes cannot support expressive search queries. They only support searching
 on single keyword. To achieve expressive queries (i.e. conjunction/disjunction
 of keywords) is significant for cloud applications due to its convenience. Fig 1
50 shows an example for PEKS supporting expressive queries. Any user can upload
 an encrypted file tagged with some keywords to a cloud service provider. Users
 can also make some queries of the conjunction/disjunction for some keywords
 to search the files they want.

55 To achieve more expressive queries, Lai et al. [9] proposed a PEKS scheme

 3

AND
 = { , , }
 = {sales, 2018, }
 Trapdoor
 OR
 corresponding to an
 
 access structure = 

 Encrypted File Cloud Service Provider 
 (CSP) = 2018 = 

 File Keyword Set The encrypted files
 Upload the encrypted file File 1 { , , } which match the
 corresponding to an = {Sales, 2018, } user’s query
 encrypted keyword set File 2 { , , }
 = {HR, 2017, }
 Data Owner Users
 File 3 { , , }
 = {IT, 2016, }

 Figure 1: Example for the Application of PEKS Supporting Expressive Queries

 motivated from Lewko et al.’s [15] key-policy attribute-based encryption (KP-
 ABE) in 2013. In 2012 Han et al. [16, 17] proposed a generic construction for
 attribute-based encryption with keyword search (ABEKS). In 2020, Shen et al.
 [18] further gave a generic construction for building PEKS from anonymous KP-
60 ABE. Note that the notion of ABEKS is different from PEKS. The former needs
 a trusted third party for issuing attribute keys to users, while in a PEKS scheme,
 users generate their public/secret key by themselves. However, there exists a
 common problem of these schemes [9, 17, 18, 19]. The test algorithm in these
 schemes will not be conducted successfully. For instance, the test algorithm in
65 [9] needs to compute the following formula.

 ωi
 e(C0 , K1,i )
 Ĉ = ∏ ( ) (1)
 i∈I e(Cρ(i) , K2,i )

 In formula 1, K1,i , K2,i represent the search token associated with keyword ρ(i)
 and Cρ(i) represents the ciphertext component associated with keyword ρ(i),
 where ρ is a map from indices to keywords. We can observe that it is necessary
 to know the correlation between (K1,i , K2,i ) and Cρ(i) , which implies that the
70 test algorithm needs to know the corresponding keyword of Cρ(i) . If the under-
 lying KP-ABE is anonymous, it will be infeasible in conducting test algorithm.
 The test algorithms in [16, 17, 18, 19, 20] are similar to that in [9], and thus
 they suffer from the same problem.

75 In order to solve the correlation problem, in 2018, Cui et al. [21] proposed

 4

a PEKS scheme with weaker anonymity notion. They separate a keyword into
 a keyword name and a keyword value. For instance, in the case of (“gender” =
 “female”), “gender” is the keyword name and “female” is the keyword value. The
 weaker anonymity in [21] only guarantees that a ciphertext reveals nothing on
80 its keyword values, while the keyword names are attached to the ciphertext. In
 the same year, Meng et al. [22] improved the efficiency of [21] by aggregating
 the ciphertext components for each attribute into a group element. However,
 their Test algorithm requires that all attributes in a ciphertext should appear
 in the access structure, or it would fail. Besides, there exists a common prob-
85 lem in [21, 22]. That is their schemes need an online and trusted third party
 to generate search tokens which is an unreasonable assumption in cryptography.

 1.2. Contribution

 In this work, we aim at proposing an efficient PEKS supporting expressive
90 search queries. Due to [18], we have a new approach to build a PEKS scheme.
 Therefore, we first propose a novel anonymous KP-ABE with provably security.
 Then, by adopting the generic construction shown in [18], we obtain a novel
 PEKS from KP-ABE supporting monotonic access structure with the following
 advantages.

95 1. Expressive queries: The proposed scheme supports monotonic formula
 in search queries.
 2. High efficiency: The proposed scheme is constructed under prime-order
 bilinear groups. Moreover, the pairings performed in the Test algorithm is
 independent of the number of attributes in ciphertexts and search tokens.
100 Besides the length of ciphertexts in the proposed scheme is shorter than
 most of the existing schemes.
 3. Formal security proof: The proposed scheme is proven to be fully secure
 in the standard model.

 5

2. Preliminaries

105 In this section, we introduce the related formal definitions of public key
 searchable encryption and other preliminaries.

 2.1. Bilinear Mapping

 In this subsection, we will introduce the definition of bilinear mappings.

 Definition 2.1. Let G, Ĝ and GT be all multiplicative cyclic groups of prime
110 order p.
 A bilinear mapping e ∶ G × Ĝ → GT satisfies the following properties in which
 g, ĝ are generators of G, Ĝ, respectively.

 • Bilinearity: e(ha , ĥb ) = e(h, ĥ)ab , ∀h ∈ G, ĥ ∈ Ĝ and a, b ∈ Zp .

 • Non-Degeneracy: There exist h ∈ G and ĥ ∈ Ĝ such that e(h, ĥ) ≠ 1.

115 • Computability: There exists an efficient algorithm to compute e(h, ĥ), ∀h ∈
 G, ĥ ∈ Ĝ.

 2.2. The DBDH-3 Problem

 In this subsection, we will introduce the definition of the DBDH-3 problem
 shown in [23], which is a variant of the decisional bilinear Diffie-Hellman in
120 asymmetric paring groups.
 $
 Definition 2.2. Given (g, ĝ, g a , g b , g c , ĝ a , ĝ b , Y ), where a, b, c ←
 Ð Zp , decide
 abc
 whether Y = e(g, ĝ) or a random element in GT .
 We say that an algorithm B that outputs a bit has the advantage  in solving
 the DBDH problem if

 abc $
 ∣Pr[B(g, ĝ, g a , g b , g c , ĝ a , ĝ b , e(g, ĝ) ) = 1] − Pr[B(g, ĝ, g a , g b , g c , ĝ a , ĝ b , Y ←
 Ð GT ) = 1]∣ ≥ .

 6

2.3. Linear Secret-Sharing Scheme (LSSS)

 We adapt the definition from those given in [24].

125 Definition 2.3. [24] A secret-sharing scheme ∏ over a set of parties P is called
 linear (over Zp ) if

 1. the shares for each party form a vector over Zp .
 2. There exists a matrix M with ` rows and n columns called the share-
 generation matrix for ∏, which can be computed from the access structure
130 A of attribute names. For the i-th row of M, i = 1, . . . , `, we let the
 function ρ define the party labelling row i as ρ(i) which maps the row i to
 an attribute name. We consider a column vector v⃗ = (s, r2 , . . . , rn ), where
 s is the value to be shared, and r2 , ..., rn ∈ Zp are randomly chosen, and
 thus M⃗
 v is the vector of ` shares of the value s according to ∏. The share
135 λi = Mi v⃗⊺ belongs to party ρ(i), where Mi is the i-th row of M.

 According to [24], every linear secret sharing-scheme satisfying the above defi-
 nitions also enjoys the linear reconstruction property. Let S be an authorized
 set and I = {i ∶ ρ(i) ∈ S} ⊆ {1, 2, . . . , `}. Then, there exist constants {ωi ∈ Zp }i∈I ,
 such that ∑i∈I ωi λi = s.

140 2.4. Access Structure

 In this subsection, we will introduce the definition of access structures used
 in the proposed scheme.

 Definition 2.4. An access structure A in our scheme conatins an (M, ρ) cor-
 responding to attribute names and a set L = (zρ(1) , . . . , zρ(`) ) corresponding
145 to attribute values of ρ(1), . . . , ρ(`), respectively. Given an access structure
 A = (M, ρ, L) a set S = (v1 , . . . , vt ) corresponding to the values of attribute
 names 1, . . . , t, respectively, we say that S satisfies A (denoted by S ⪯ A), if:

 • there exists an index set I = {i ∶ ρ(i) ∈ [1, t]}, such that, there exsit
 constants {ωi }i∈I satisfing ∑i∈I ωi Mi = (1, 0, . . . , 0);

150 • for i ∈ I, vρ(i) = zρ(i) .

 7

2.5. Public Key Searchable Encryption
 A public key searchable encryption [5, 9] consists of four algorithms.

 • Setup(1λ ) : Take as input a security parameter λ. It outputs a pub-
 lic/secret key pair (P K, SK).

155 • Encrypt(P K, W ) : Take as inputs the public key P K and a keyword set
 W . It outputs a ciphertext CTW .

 • Trapdoor(P K, SK, P) : Take as inputs the public key P K, the secret
 key SK and a predicate P. It outputs a search token T KP . Note that
 the search tokens are also known as trapdoors in the literatures. In this
160 work, we sometimes use “trapdoor” to denote a search token.

 • Test(P K, T KP , CTW ) : Take as inputs the public key, a search token
 T KP and a ciphertext CTW . If the keyword set W satisfies the predicate
 P, the algorithm outputs 1; otherwise, outputs 0.

 The predicate supported by our scheme is monotonic formula represented by lin-
165 ear secret sharing schemes. Next we show the definition for public key searchable
 encryption, called IND-CKA security (i.e. indistinguishability against chosen
 keyword attacks). The notion states that a ciphertext in an SE scheme reveals
 no information about its keywords.

 Definition 2.5. (IND-CKA Security)
170

 - Setup: A challenger runs the Setup algorithm and gives the public pa-
 rameters to the adversary.

 - Phase 1: The adversary is allowed to issue polynomially many queries for
 trapdoors T with access structures Aj ’s.

175 - Challenge: The adversary submits two equal-size keywords sets W0∗ and
 W1∗ . The sets W0∗ and W1∗ should not satisfy any trapdoor that has been
 queried in Phase 1. The challenger flips a random coin b, and gnerate a
 ciphertext C ∗ with Wb∗ . The ciphertext C ∗ is passed to the adversary.

 8

- Phase 2: The adversary repeats the steps in Phase 1.

180 - Guess: The adversary outputs the guess b′ ∈ {0, 1} of b and wins the game
 if b′ = b.

 The advantage of the adversary in this game is defined as AdvA
 IN D-CKA
 =
 ∣P r[b′ = b] − 21 ∣. A PEKS scheme is said to be semantically secure if for ev-
 ery polynomial-time adversary A, AdvA
 IN D-CKA
 is at most negligible.

185 Remark 1. There is another security notion called “keyword privacy”, which is
 analogous to the notion “function-private” [25] in functional encryption. Key-
 word privacy states that a trapdoor reveals no information about its keywords
 (or policy). However, as that stated in [20], it is impossible to achieve for PEKS.
 The reason is obvious, i.e. given a trapdoor, anyone can generate a ciphertext
190 for any keywords under her/his choice, and thus reveal the information of the
 given trapdoor by performing the Test algorithm with the trapdoor and the
 ciphertext. Since our goal is to solve the problems for PEKS, we only focus on
 the IND-CKA security of the proposed scheme.

 2.6. Definition and Security Model for Key-Policy Attribute-Based Encryption
195 KP-ABE was first proposed by Goyal et al. in [26], which is the dual con-
 struction of ciphertext-policy attribute-based encryption (CP-ABE) [27, 28]. A
 KP-ABE consists of the following four algorithms.

 • Setup(1λ ) : The input is the security parameter 1λ . The algorithm
 outputs the public parameter P K and the master secret key M SK.

200 • KeyGen(P K, M SK, A) : The inputs are the public parameter P K, mas-
 ter secret key M SK, and the access structure A which is assigned by Key
 Generation Center (KGC) to the user. The algorithm outputs a decryp-
 tion key SKA which contains the information of access structure.

 • Encrypt(P K, S, M ) : The inputs are the public parameter param, a set
205 of descriptive attributes S, and a message M . The algorithm outputs a
 ciphertext CT .

 9

• Decrypt(CT, SKA ) : This algorithm is run by the receiver. The inputs
 are a ciphertext CT which was encrypted under the set of attributes S,
 and the decryption key SKA for access structure A. The algorithm outputs
210 the message M if S ⪯ A.

 Next we give the security notion of KP-ABE. There are two security no-
 tions for KP-ABE, IND-CPA security and ANON-CPA security. The IND-CPA
 security defines that a ciphertext does not reveal any information about the en-
 crypted message, and the ANON-CPA defines that a ciphertext reveals nothing
215 to the attribute set.

 Definition 2.6. (IND-CPA Security)
 We provide the IND-CPA security model for a KP-ABE scheme.

 - Setup: A challenger runs the Setup algorithm to generate public pa-
 rameters and master secret key, and gives the public parameters to the
220 adversary.

 - Phase 1: The adversary is allowed to issue polynomially many queries for
 private keys with access structures Aj .

 - Challenge: The adversary submits two equal-length messages M0 and M1
 along with an attribute set S ∗ , where S ∗ should not satisfy any access
225 structure Aj queried in Phase 1. The challenger flips a random coin b,
 and encrypts Mb with A∗ . The ciphertext is passed to the adversary.

 - Phase 2: The adversary repeats the steps in Phase 1.

 - Guess: The adversary outputs the guess b′ ∈ {0, 1} of b and wins the game
 if b′ = b.

230 The advantage of the adversary in this game is defined as AdvA
 IN D−CP A
 =
 ∣P r[b′ = b] − 21 ∣. A KP-ABE scheme is said to be IND-CPA secure if for ev-
 ery polynomial-time adversary A, AdvA
 IN D−CP A
 is at most negligible.

 Definition 2.7. (ANON-CPA Security)
 We provide the ANON-CPA security models for a KP-ABE scheme.

 10

235 - Setup: A challenger runs the Setup algorithm and gives the public pa-
 rameters to the adversary.

 - Phase 1: The adversary is allowed to issue polynomially many queries for
 private keys with access structures Aj ’s.

 - Challenge: The adversary submits two equal-size sets S0∗ and S1∗ and a
240 message M . The sets S0∗ and S1∗ should not satisfy any key that has been
 queried in Phase 1. The challenger flips a random coin b, and encrypts M
 with Sb∗ . The ciphertext is passed to the adversary.

 - Phase 2: The adversary repeats the steps in Phase 1.

 - Guess: The adversary outputs the guess b′ ∈ {0, 1} of b and wins the game
245 if b′ = b.

 AN ON −CP A
 The advantage of the adversary in this game is defined as AdvA =
 ∣P r[b′ = b] − 12 ∣. A KP-ABE scheme is said to be ANON-CPA secure if for every
 AN ON −CP A
 polynomial-time adversary A, AdvA is at most negligible.

 The models can be easily extended to handle chosen-ciphertext attacks by
250 allowing for decryption queries in Phase 1 and Phase 2.

 2.7. Public Key Searchable Encryption from KP-ABE
 In [18], Shen et al. give a generic construction of a public key searchable
 encryption scheme from a KP-ABE scheme supporting monotonic queries. The
 construction is an extension of that proposed in [2, 4], which builds a PEKS from
255 a given identity-based encryption. Intuitively, the keywords can be regarded
 as attributes in KP-ABE. Additionally, we can regard the access structure as
 a search query associated with a trapdoor. Then, the KeyGen algorithm of
 KP-ABE can be performed as the Trapdoor algorithm of PEKS to generate
 a trapdoor for an access policy. The Encrypt algorithm of KP-ABE can be
260 performed as the Encrypt algorithm of PEKS, the Decrypt algorithm of KP-
 ABE can be used for the Test algorithm of PEKS. More precisely, given a
 KP-ABE Π = (Setup, Encrypt, KeyGen, Decrypt), a PEKS is given as follows.

 11

- Setup(1λ ): Run Π.Setup(1λ ) → (P K, M SK), and output (P K, SK) =
 (P K, M SK).

265 - Encrypt(P K, W ): Choose a random message m, and compute Π.Encrypt(P K, W, m) →
 CT . Output C = (CT, m).

 - Trapdoor(P K, SK, A): Generate a trapdoor T KA for an access policy A
 as T KA ← Π.KeyGen(SK, A).

 - Test(P K, T KA , C = (CT, m)): Output 1 if m = Π.Decrypt(CT, T KA );
270 output 0 otherwise.

 The correctness of the generic construction is easily derived from the correct-
 ness of the underlying KP-ABE. On the other hand, like the generic construction
 given in [2, 4], the security of the PEKS relies upon the anonymity of the un-
 derlying KP-ABE, since the transformation regards keywords as the attributes
275 in the underlying KPABE. Next we show that the construction is secure based
 on the security of the underlying KP-ABE.

 Theorem 2.1. If the KP-ABE is ANON-CPA secure, then the PEKS form the
 KP-ABE is IND-CKA secure.

 The detailed proof of this theorem can be refered to [18].

280 3. The Proposed Anonymous KP-ABE and PEKS

 In this section, we first give a new anonymous KP-ABE scheme, and then
 give an efficient PEKS scheme via the transformation shown in Section 2.7.

 3.1. The Proposed KP-ABE

 Let G and Ĝ be two multiplicative groups of prime order p, and e ∶ G × Ĝ →
285 GT be the bilinear map. The details of our scheme are described as follows.

 12

3.1.1. Setup
 Setup(1λ ) → (P K, M SK). Given a security parameter 1λ . To generate
 the system parameters, the KGC performs the following steps:

 1. Generate generators g and ĝ of G and Ĝ, respectively.
 ∗
290 2. Choose a hash functions H ∶ {0, 1} → Zp .
 3. Randomly select φ ∈ Zp , and compute h = g φ and ĥ = ĝ φ .
 4. Randomly select α, β ∈ Zp , and compute U = e(g, ĝ)α(β−1) and V =
 e(g, ĝ)αβ .
 5. The public parameters is PK = {G, Ĝ, e, g, U, V, h, H}, and the master
295 secret key is MSK = {ĝ, ĝ α , ĥ}. Keep the master secret key M SK secret.

 3.1.2. KeyGen
 KeyGen(P K, M SK, A = (M, ρ, L)) → SKA . The KGC takes as input the
 master secret key and an LSSS access structure A = (M, ρ, L). Let M be an
 ` × n matrix. The function ρ associates rows of M to attribute names. Let
300 L = (zρ(1) , ..., zρ(`) ) be the attribute values corresponding to ρ(1), . . . , ρ(`), re-
 spectively. Let τ be the set of distinct attribute names existing in the access
 structure matrix M . To generate a secret key associated with the access struc-
 ture A, the KGC performs the following steps:

 1. Select a random vector v⃗ = (s, y2 , ..., yn ) where s = 1.
305 2. Compute λi = Mi v⃗⊺ for i = 1 to `, where Mi is the i-th row of M .
 3. Select random numbers ri ∈ Zp for i = 1 to `.
 4. Compute σ̂i = ĝ H(ρ(i)∣∣zρ(i) ) ⋅ ĥ for i = 1 to `.
 5. For i = 1 to `, compute di,0 = ĝ α⋅λi ⋅ σ̂i ri , ∀j ∈ τ /ρ(i), Qi,j = σˆj ri , and
 di,1 = ĝ ri .
310 6. The secret key is SK = ({di,0 , di,1 , {Qi,j }j∈τ /ρ(i) }`i=1 ).

 3.1.3. Encrypt
 Encrypt(P K, S, m) → CT . The algorithm takes as input the public pa-
 rameters P K, a message m ∈ GT , and an attribute value set S = (v1 , ..., vt ),

 13

where vi is the value of attribute name i. Let S̃ be the the set of attribute
315 names from S. S̃ should be published with the ciphertext in order to decrypt.
 Note that the attribute values are not revealed to others. To generate a cipher-
 text of m associated with S, the algorithm performs the following steps:

 1. Select a random number k ∈ Zp .
 2. Compute C1 = V k ⋅ m = e(g, ĝ)αβk ⋅ m.
320 3. Compute C2 = U k = e(g, ĝ)α(β−1)k .
 4. Compute C3 = g k .
 5. Compute σi = g H(i∣∣vi ) ⋅ h for i = 1 to t.
 6. Compute C4,i = σi k for i = 1 to t.
 7. The ciphertext is CT = (C1 , C2 , C3 , {C4,i }ti=1 , S̃).

325 3.1.4. Decrypt
 Decrypt(CT, SKA ). If the set of attribute names S̃ does not satisfy the
 access structure A, it outputs –. Otherwise, let I ⊆ {1, 2, ..., `} be a set of
 indices and {ωi }i∈I ∈ Zp be a set of constants such that ∀i ∈ I, ρ(i) ∈ S̃ and
 ∏i∈I ωi Mi = (1, 0, ..., 0). Then we define ∆ = {x ∶ ∃i ∈ I, ρ(i) = x} and fˆ(∆) =
330 ∏x∈∆ σˆx , f (∆) = ∏x∈∆ σx . For each i ∈ I, compute dˆi,0 = di,0 ⋅ ∏x∈∆/ρ(i) Qi,x =
 ĝ α⋅λi fˆ(∆)ri . Compute L = ∏x∈∆ C4,x = ∏x∈∆ σxk = f (∆)k . Then compute the
 following algorithm to decrypt the message m as follows:

 e(C3 , ∏i∈I dˆω
 i,0 )
 i

 Z =
 i,1 )
 e(L, ∏i∈I dω i

 ∑i∈I ωi ri
 e(g k , ĝ α ∑i∈I λi ωi fˆ(∆) )
 = k
 e(f (∆) , ĝ ∑i∈I ri ωi )
 αk
 = e(g, ĝ)
 C1 e(g, ĝ)αβk ⋅ m
 m = =
 C2 ⋅ Z e(g, ĝ)α(β−1)k ⋅ e(g, ĝ)αk
 The proposed KP-ABE scheme adopts the technique used in [29] to achieve
 fast decryption. The decryption in our KP-ABE needs only 2 parings, which
335 is independent of the numbers of attributes in the ciphertext or the secret key.

 14

Furthermore, by adopting the transformation shown in Subsection 2.7, we obtain
 an efficient searchable encryption with constant pairings in the Test algorithm.

 3.2. The PEKS from The Proposed KP-ABE

 In Subsection 3.1, we proposed an anonymous KP-ABE with high efficiency.
340 As mentioned in Subsection 2.7, an anonymous KP-ABE can be transformed
 into a searchable encryption. In order to avoid the unnecessary repetition, we
 only give an intuition in this section. The main idea is to view keywords in PEKS
 as attributes in KP-ABE. First, we regard the access structure as a search query
 associated with a trapdoor. Then, the KeyGen algorithm of KP-ABE can be
345 performed as the Trapdoor algorithm of PEKS to generate a trapdoor for an
 access policy. Since the underlying KP-ABE supports expressive access struc-
 tures, and thus the proposed PEKS supports expressive queries. The Encrypt
 algorithm of KP-ABE can be slightly modified into the Encrypt algorithm of
 PEKS by encrypting a randomly chosen message M , and outputting M along
350 with the ciphertext C outputted from the Encryption algorithm of KP-ABE. As
 for the Test algorithm, one uses the Decrypt algorithm of KP-ABE to decrypt
 C and obtain a message M ′ , and then check whether M = M ′ . The reader is
 referred to Section 2.7 for details.

 4. Conclusion

355 Public key searchable encryption with expressive queries is necessary for
 people to search encrypted files, due to the widely usage of cloud services nowa-
 days. However, the existing schemes which support monotonic queries suffer
 from problems such as heavy computation cost, infeasibility or incorrect in test-
 ing, weaker security notion, polynomial keyword space, and the requirement of
360 online trusted third party. In this work, we focus on constructing a new pub-
 lic key searchable encryption to overcome the aforementioned drawbacks. The
 security proof and the comparison will be presented in the full version of this
 paper.

 15

Acknowledgments

365 This work was partially supported by the Ministry of Science and Technol-
 ogy of Taiwan under grants MOST 110-2218-E-110-007-MBK, MOST 109-2221-
 E-110-044-MY2, MOST 110-2923-E-110-001-MY3, MOST 108-2218-E-004-002-
 MY2, and MOST 110-2221-E-004-003-.

 References

370 [1] D. X. Song, D. Wagner, A. Perrig, Practical techniques for searches on
 encrypted data, in: Proceeding 2000 IEEE Symposium on Security and
 Privacy. S P 2000, 2000, pp. 44–55.

 [2] D. Boneh, G. D. Crescenzo, R. Ostrovsky, G. Persiano, Public key encryp-
 tion with keyword search, in: Advances in Cryptology - EUROCRYPT
375 2004, 2004, pp. 506–522.

 [3] R. Curtmola, J. Garay, S. Kamara, R. Ostrovsky, Searchable symmet-
 ric encryption: Improved definitions and efficient constructions, in: Pro-
 ceedings of the 13th ACM Conference on Computer and Communica-
 tions Security, CCS ’06, ACM, New York, NY, USA, 2006, pp. 79–88.
380 doi:10.1145/1180405.1180417.
 URL http://doi.acm.org/10.1145/1180405.1180417

 [4] M. Abdalla, M. Bellare, D. Catalano, E. Kiltz, T. Kohno, T. Lange,
 J. Malone-Lee, G. Neven, P. Paillier, H. Shi, Searchable encryption revis-
 ited: Consistency properties, relation to anonymous IBE, and extensions,
385 in: Advances in Cryptology – CRYPTO 2005, 2005, pp. 205–222.

 [5] D. Boneh, B. Waters, Conjunctive, subset, and range queries on encrypted
 data, in: Theory of Cryptography, Springer Berlin Heidelberg, 2007, pp.
 535–554.

 16

[6] J. Katz, A. Sahai, B. Waters, Predicate encryption supporting disjunctions,
390 polynomial equations, and inner products, in: Advances in Cryptology –
 EUROCRYPT 2008, 2008, pp. 146–162.

 [7] C.-I. Fan, V. S.-M. Huang, H.-M. Ruan, Arbitrary-state attribute-based
 encryption with dynamic membership, IEEE Transactions on Computers
 63 (8) (2014) 1951–1961. doi:10.1109/TC.2013.83.

395 [8] S.-Y. Huang, C.-I. Fan, Y.-F. Tseng, Enabled/disabled predicate encryp-
 tion in clouds, Future Generation Computer Systems 62 (2016) 148–160.
 doi:https://doi.org/10.1016/j.future.2015.12.008.
 URL https://www.sciencedirect.com/science/article/pii/
 S0167739X15003921

400 [9] J. Lai, X. Zhou, R. Deng, X. Li, K. Chen, Expressive search on encrypted
 data, in: Proceedings of the 8th ACM SIGSAC Symposium on Information,
 Computer and Communications Security, 2013, pp. 243–252.

 [10] A. Guillevic, Comparing the pairing efficiency over composite-order and
 prime-order elliptic curves, in: Applied Cryptography and Network Secu-
405 rity, 2013, pp. 357–372.

 [11] M. H. Ameri, M. Delavar, J. Mohajeri, M. Salmasizadeh, A key-policy
 attribute-based temporary keyword search scheme for secure cloud storage,
 IEEE Transactions on Cloud Computing (2018) 1–1.

 [12] Y. Miao, J. Ma, X. Liu, X. Li, Q. Jiang, J. Zhang, Attribute-based keyword
410 search over hierarchical data in cloud computing, IEEE Transactions on
 Services Computing (2018) 1–1.

 [13] Y. Miao, J. Ma, X. Liu, J. Weng, H. Li, Lightweight fine-grained search
 over encrypted data in fog computing, IEEE Transactions on Services Com-
 puting (2018) 1–1.

 17

415 [14] H. Wang, X. Dong, Z. Cao, Multi-value-independent ciphertext-policy at-
 tribute based encryption with fast keyword search, IEEE Transactions on
 Services Computing (2018) 1–1.

 [15] A. Lewko, T. Okamoto, A. Sahai, K. Takashima, B. Waters, Fully secure
 functional encryption: Attribute-based encryption and (hierarchical) inner
420 product encryption, in: Advances in Cryptology – EUROCRYPT 2010,
 2010, pp. 62–91.

 [16] H. Fei, Q. Jing, Z. Huawei, H. Jiankun, A general transformation from
 KP-ABE to searchable encryption, in: Cyberspace Safety and Security,
 Springer Berlin Heidelberg, 2012, pp. 165–178.

425 [17] F. Han, J. Qin, H. Zhao, J. Hu, A general transformation from KP-ABE to
 searchable encryption, Future Generation Computer Systems 30 (2014) 107
 – 115, special Issue on Extreme Scale Parallel Architectures and Systems,
 Cryptography in Cloud Computing and Recent Advances in Parallel and
 Distributed Systems, ICPADS 2012 Selected Papers. doi:https://doi.
430 org/10.1016/j.future.2013.09.013.

 [18] C. Shen, Y. Lu, J. Li, Expressive public-key encryption with keyword
 search: Generic construction from kp-abe and an efficient scheme over
 prime-order groups, IEEE Access 8 (2020) 93–103. doi:10.1109/ACCESS.
 2019.2961633.

435 [19] Z. Lv, C. Hong, M. Zhang, D. Feng, Expressive and secure searchable
 encryption in the public key setting, in: Information Security, 2014, pp.
 364–376.

 [20] Q. Zheng, S. Xu, G. Ateniese, VABKS: Verifiable attribute-based keyword
 search over outsourced encrypted data, in: IEEE INFOCOM 2014 - IEEE
440 Conference on Computer Communications, 2014, pp. 522–530.

 [21] H. Cui, Z. Wan, R. H. Deng, G. Wang, Y. Li, Efficient and expressive

 18

keyword search over encrypted data in cloud, IEEE Transactions on De-
 pendable and Secure Computing 15 (3) (2018) 409–422.

 [22] R. Meng, Y. Zhou, J. Ning, K. Liang, J. Han, W. Susilo, An efficient
445 key-policy attribute-based searchable encryption in prime-order groups, in:
 Provable Security, Cham, 2017, pp. 39–56.

 [23] S. Chatterjee, A. Menezes, On cryptographic protocols employing asym-
 metric pairings - the role of ψ revisited, Discrete Applied Mathematics
 159 (13) (2011) 1311 – 1322. doi:https://doi.org/10.1016/j.dam.
450 2011.04.021.

 [24] A. Beimel, Secure schemes for secret sharing and key distribution,
 Technion-Israel Institute of technology, Faculty of computer science, 1996.

 [25] D. Boneh, A. Raghunathan, G. Segev, Function-private identity-based en-
 cryption: Hiding the function in functional encryption, in: R. Canetti, J. A.
455 Garay (Eds.), Advances in Cryptology – CRYPTO 2013, Springer Berlin
 Heidelberg, Berlin, Heidelberg, 2013, pp. 461–478.

 [26] V. Goyal, O. Pandey, A. Sahai, B. Waters, Attribute-based encryption for
 fine-grained access control of encrypted data, in: Proceedings of the 13th
 ACM conference on Computer and communications security, 2006, pp. 89–
460 98.

 [27] Y.-F. Tseng, C.-I. Fan, C.-W. Lin, Provably secure ciphertext-policy
 attribute-based encryption from identity-based encryption, Journal of Uni-
 versal Computer Science 25 (3) (2019) 182–202.

 [28] C.-I. Fan, Y.-F. Tseng, J.-J. Huang, S.-F. Chen, H. Kikuchi, Multire-
465 ceiver predicate encryption for online social networks, IEEE Transactions
 on Signal and Information Processing over Networks 3 (2) (2017) 388–403.
 doi:10.1109/TSIPN.2017.2697580.

 [29] S. Hohenberger, B. Waters, Attribute-based encryption with fast decryp-
 tion, in: K. Kurosawa, G. Hanaoka (Eds.), Public-Key Cryptography –

 19

470 PKC 2013, Springer Berlin Heidelberg, Berlin, Heidelberg, 2013, pp. 162–
 179.

 20